Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add redai-infra/Relax --skill sync-githubgit clone --depth 1 https://github.com/redai-infra/RelaxWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/redai-infra/relax/sync-github)<a href="https://agentmods.dev/skills/redai-infra/relax/sync-github"><img src="https://agentmods.dev/badge/skills/redai-infra/relax/sync-github/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/redai-infra/relax/sync-github"><img src="https://agentmods.dev/badge/skills/redai-infra/relax/sync-github.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 42 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 42 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.02733 |
| Opus 5.5 | $0.00023 | $0.01093 |
| Sonnet 5.5 | $0.00011 | $0.00547 |
| Haiku 4.5 | $0.00006 | $0.00273 |
Grade A, and why
sync-github scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
sync-github
同步内部 GitLab 与外部 GitHub 时使用。这个 skill 是入口和规则层；完整可执行流程拆成两个 prompt reference。
两阶段硬规则
每次完整同步必须分成两个独立人工闸门阶段，不能一次跑完：
- Prompt A：GitHub -> GitLab dev
扫描gitlab/dev最近提交里所有(cherry picked from commit <sha>)尾巴以及 Prompt A 替身 commit 里显式提到的 github SHA，得到「已进 dev 的 github commit 集合」；在github/mainfirst-parent 链上落到该集合的最新一条即github_anchor，之后的 PR commit 就是本次要 cherry-pick 的外部 commit。落到 GitLab CR 分支后必须停止，等待云效 CR 合入。 - Prompt B：GitLab dev -> GitLab/GitHub main
只能在用户明确说“内部 CR 已合入，继续同步”后执行。扫描gitlab/main顶端最近提交的(cherry picked from commit <sha>)尾巴，第一条尾巴指向的 dev SHA 就是本次的BASE；BASE..gitlab/dev按顺序去掉 sync 合并、Prompt A 替身、纯内部 merge 节点后线性cherry-pick -x到本地main，再直接推送到gitlab/main、走 GitHub push 门禁推到github/main。不要创建sync/dev-to-main。
禁止在 Prompt A 中 push GitHub。禁止跳过 Prompt A 直接做 dev -> main。
Prompt A 禁止通过 merge 把 github/main 纳入 gitlab/dev；必须走 commitA + external PR commit cherry-pick 流程。
必须先判断阶段
- 开始一次同步，或用户没有明确说“内部 CR 已合入”：读取并执行 references/prompt-a-main-to-dev.md。
- 用户明确说“内部 CR 已合入，继续同步”：读取并执行 references/prompt-b-dev-to-main.md。Prompt B 直接更新并推送
gitlab/main；如果github/main落后于gitlab/main，不要回退gitlab/main，继续在gitlab/main基础上追加dev内容，最后停在 GitHub push 门禁。 - 不确定阶段时，只做只读检查：
git status --porcelain、git status --porcelain --untracked-files=no、git fetch --all --prune，再运行python skills/sync-github/scripts/plan_github_to_dev.py --github github/main --dev gitlab/dev判断是否还有未吸收的外部 PR commit。不要根据gitlab/main/github/main关系跳过 Prompt A。
BASE 定位硬规则
Prompt A / Prompt B 都靠 git cherry-pick -x 留下的 (cherry picked from commit <sha>) 尾巴来定位起点。历次 cherry-pick 必须都带 -x，这是下一次同步能自动找到 base 的唯一凭据。
- Prompt B：
gitlab/main顶端往下第一条带cherry picked from尾巴的 commit，尾巴里的 dev SHA 就是BASE。主题带(#数字)的 GitHub PR 直推 commit 直接跳过。找不到尾巴时停止让用户确认。 - Prompt A：把
gitlab/dev最近若干条 commit body 里的cherry picked from commit <sha>尾巴以及 Prompt A 替身 commit（chore(sync): replay github external changes一类）body 里显式列出的 github SHA 全部收集起来，落到github/mainfirst-parent 链上的最新一条就是github_anchor。之后按序的 PR commit 就是本轮外部 commit 候选。 - Prompt B 的工作队列来自
BASE..gitlab/dev的历史切片；git diff gitlab/main..gitlab/dev只用来在队列执行完之后核验漏搬，git rev-list --right-only只用来审计跳过项，两者都不是 cherry-pick 输入。 - 队列中永远跳过：
Merge branch sync/github-main-to-dev-...、chore(sync): replay github external changes、纯内部 merge 节点。只有 merge commit 带有当前 tree diff 仍需要的真实冲突解决时才作为普通线性 commit 重放。 - 如果 Prompt A 已实际验证某个 GitHub external commit cherry-pick 到
gitlab/dev为空/已吸收，而plan_github_to_dev.py仍报告not-in-dev，按人工审计 false positive 记录后继续，不要再次要求用户确认。
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 147 lines · 57 tokens per session scan A b0044aa838db
sync-github is a skill published in the GitHub repository redai-infra/Relax (580 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 57 tokens to every session and 2,733 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
verl-rl-training
Provides guidance for training LLMs with reinforcement learning using verl (Volcano Engine RL). Use when implementing RLHF, GRPO, PPO, or other RL algorithms for LLM post-training at scale with flexible infrastructure backends.
openrlhf-training
High-performance RLHF framework with Ray+vLLM acceleration. Use for PPO, GRPO, RLOO, DPO training of large models (7B-70B+). Built on Ray, vLLM, ZeRO-3. 2× faster than DeepSpeedChat with distributed architecture and GPU resource sharing.
verl-rl-training
Provides guidance for training LLMs with reinforcement learning using verl (Volcano Engine RL). Use when implementing RLHF, GRPO, PPO, or other RL algorithms for LLM post-training at scale with flexible infrastructure backends.
verl-rl-training
Provides guidance for training LLMs with reinforcement learning using verl (Volcano Engine RL). Use when implementing RLHF, GRPO, PPO, or other RL algorithms for LLM post-training at scale with flexible infrastructure backends.
openrlhf-training
High-performance RLHF framework with Ray+vLLM acceleration. Use for PPO, GRPO, RLOO, DPO training of large models (7B-70B+). Built on Ray, vLLM, ZeRO-3. 2× faster than DeepSpeedChat with distributed architecture and GPU resource sharing.
openrlhf-training
High-performance RLHF framework with Ray+vLLM acceleration. Use for PPO, GRPO, RLOO, DPO training of large models (7B-70B+). Built on Ray, vLLM, ZeRO-3. 2× faster than DeepSpeedChat with distributed architecture and GPU resource sharing.